Re: [TLS] Twist security for brainpoolp256r1

[Oleg Gryb <[e-mail]>]

> It's the cost of an attack for an attacker who can force you to accept a 

> point
> that is not on the curve but on its non-quadratic twist.
> 
> In the context of TLS (with the currently available curves and point formats)
> what safecurves calls "twist security" is totally irrelevant: either 
> the
> implementation validates that points are on the curve, or you're vulnerable 
> to
> an invalid curve attack which is much more powerful than a twist attack.
> 
> Any decent implementation (which includes OpenSSL and some others) of ECC with
> TLS will check that points belong on the intended curve.


It answers my question, thanks.

>>  The last question that I have is related to brainpool curves 
> implementations in openssl.
> 
> This question is more suited to the OpenSSL list, as it is specific to this
> implementation. This list is about the protocol.


What about EC arithmetic optimization specific to a curve? Is it a kind of qs that is appropriate for this forum? If it is, probably somebody can provide pointers about optimizations that have been already implemented for the curve in the subject. I think, efficiency should be an important consideration of this protocol.